The pipe nobody sees until it bursts
A bank in a country you've barely thought about collapses overnight. By afternoon, markets three time zones away are falling. By the following week, a pension fund in your own city is quietly writing down assets, and nobody on television is explaining the mechanism with any precision. The headlines call it "contagion," which is technically accurate and practically useless, because it tells you nothing about the pipe through which the infection travelled.
That pipe is interbank settlement. The architecture of how banks settle obligations with each other is, without much exaggeration, the single most consequential piece of financial infrastructure that most educated people have never thought about for sixty consecutive seconds.
Certain settlement architectures create invisible cross-border exposure because they net obligations across participants before settling, meaning a failure anywhere in the chain can crystallise losses everywhere simultaneously, often before any regulator has processed what's happening. That is the short answer. The longer one is where it gets genuinely interesting.
Gross versus net: a difference that costs billions
Every time one bank owes money to another, a payment instruction has to be settled. There are two fundamental ways to do this.
In a real-time gross settlement system (RTGS), each payment settles individually and immediately, in central bank money, as it arrives. The UK's CHAPS system works this way. So does Fedwire in the United States. Payment goes in, payment goes out, obligation extinguished. Clean.
In a deferred net settlement system (DNS), banks accumulate obligations to each other across a trading day and settle only the net difference at a designated point, typically end of day. If Bank A owes Bank B 400 million and Bank B owes Bank A 350 million, only the 50 million net difference actually moves. Elegant. Capital-efficient. And, under the right conditions, a loaded gun pointed at the whole chain.
The efficiency of netting is real. Across a system processing, say, 800 billion in daily gross obligations, netting might reduce actual settlement flows to under 50 billion, liquidity savings that genuinely matter to institutions managing intraday cash positions. But the cost is that every participant in the net carries unsettled exposure to every other participant until the end-of-day calculation runs. If one bank fails before settlement, the net unwinds. Obligations that were considered offset suddenly aren't. Banks that believed they had no exposure discover they do, and because modern correspondent banking ties domestic DNS systems to international flows, that unwinding doesn't respect borders any more than a burst main respects property lines.
The correspondent chain and where it frays
Most cross-border payments don't flow directly between two banks. They travel through a chain of correspondent relationships, where one bank holds accounts for another and processes payments on its behalf. A mid-sized bank in Warsaw or Nairobi typically doesn't hold a direct settlement account at the Federal Reserve or the European Central Bank. It routes through a larger correspondent, which routes through another, which eventually reaches the settlement layer.
Efficient. Also how a problem in one node transmits into multiple others without anyone intending it.
Consider a plausible scenario. A regional bank in a mid-sized economy, call it Meridian Bank, runs a correspondent relationship with a large international bank, call it Continental Trust, which itself uses a major US dollar clearing bank to settle dollar-denominated trades. Meridian has no direct exposure to whatever Continental Trust is doing in its proprietary trading book. But if Continental Trust hits a severe liquidity crisis before the daily DNS window closes, Meridian's intraday dollar positions are suddenly frozen. It can't send payments. Its own correspondents, waiting for funds to arrive from Meridian, now face gaps. The chain seizes, each link having managed its bilateral exposure carefully while nobody managed the systemic one. It is the financial equivalent of every driver on a motorway braking safely, individually, and producing a pile-up nonetheless.
This is precisely the mechanism that made the stress in dollar funding markets so disorienting during the 2008 crisis. The exposures weren't visible on individual balance sheets. They lived in the settlement architecture, and they surfaced only when the architecture began to fail.
The CLS system: a partial fix and what it leaves out
The industry's most significant structural response to cross-border settlement risk is CLS Bank, which stands for Continuous Linked Settlement. Now settling the majority of global foreign exchange transactions by value, CLS addresses a specific and historically devastating problem called Herstatt risk.
Herstatt risk takes its name from a small German bank that failed in 1974. Counterparties had already paid deutschmarks to Herstatt, expecting to receive US dollars in return later the same day. When German regulators closed the bank between the two legs of the trade, the dollar payments never came. Counterparties had delivered and received nothing. Across a modern FX market processing trillions daily, the same failure mode would be catastrophic.
CLS eliminates this by settling both legs of a currency trade simultaneously, payment-versus-payment, across all participating currencies in a narrow five-hour window each day when operating hours of major central banks overlap. Meridian Bank and Continental Trust both deliver their respective currencies into CLS at the same moment, or neither payment goes through. The bilateral exposure collapses to near zero.
But CLS only covers what CLS covers. It handles FX settlement across its member currencies. It does not cover securities settlement, money market transactions, derivatives collateral movements, or the vast volume of dollar clearing that flows through the private CHIPS system (Clearing House Interbank Payments System) in New York. CHIPS uses a form of multilateral netting with real-time finality for matched payments, which is more robust than pure DNS, but it still concentrates enormous dollar flows through a small number of settlement banks. Not every currency, not every counterparty, and not every transaction type sits inside the architecture that CLS protects. The safety net has significant gaps, and the gaps are not evenly distributed across the system.
What people consistently get wrong about settlement risk
The most common misconception is that settlement risk is the same as credit risk, and that capital buffers solve it.
They don't.
Credit risk is about whether a counterparty can pay. Settlement risk is about whether a counterparty pays at the right moment, in the right form, through the right channel. A bank can be entirely solvent at 9am and still trigger a settlement failure by 11am if it hits a liquidity squeeze, a technical outage, or a regulatory freeze. Capital adequacy ratios tell you nothing about that. The Basel frameworks have steadily improved their treatment of liquidity risk, introducing the Liquidity Coverage Ratio and the Net Stable Funding Ratio, but neither metric directly captures intraday settlement exposure. A bank can pass both tests and still be a dangerous node in a settlement chain if it is relying on incoming payments to fund outgoing ones, which many do, and which no quarterly filing will tell you.
Ask yourself this: when did you last read a bank's settlement-infrastructure dependencies in a disclosure document? The answer is almost certainly never, because they are not required to disclose them in any useful form.
The other thing people get wrong is imagining that bigger banks are automatically safer nodes. A large bank is a large node. Its failure, or even a temporary freeze, withdraws more liquidity from more participants simultaneously than the failure of a smaller institution. The concentration of dollar clearing among a handful of major US banks is a feature in terms of efficiency and a risk in terms of systemic fragility. Both things are true at the same time, and the banking system has chosen efficiency repeatedly when the two conflict. That is not a neutral outcome. It is a policy choice made by private institutions with the implicit backing of public balance sheets, and it deserves more scrutiny than it generally receives.
Why some crises cross borders and others don't
Not every bank failure goes global. The architecture explains which ones do.
A bank that fails but sits at the edge of the correspondent network, with limited settlement relationships and modest intraday positions, tends to produce losses that are contained. Creditors take hits. The settlement system keeps running. The crisis is real but local.
A bank that sits at or near a settlement hub, one that other banks depend on to process payments, to provide intraday liquidity, or to bridge settlement timing gaps across time zones, produces a different kind of failure entirely. Its distress doesn't just create credit losses for counterparties. It removes the infrastructure those counterparties rely on to function. Payments queue. Liquidity drains. Banks that have no direct exposure to the failing institution discover they cannot settle their own unrelated obligations because the plumbing has seized.
This is why central banks have consistently chosen to support large settlement-critical institutions during crises even when the political cost was severe. The Federal Reserve's actions during the 2008 period, the ECB's various liquidity operations, the Bank of England's emergency interventions: these were not straightforwardly about the solvency of individual banks. They were about keeping settlement infrastructure functional. A bank can be allowed to fail as a legal entity. The settlement function it was performing cannot be allowed to fail, at least not on short notice, without consequences that spread faster than any regulatory intervention can travel. Historians of financial crises who focus on the drama of individual institutions tend to miss this point almost entirely.
Understand which banks sit at which nodes in which settlement systems, and you understand which failures stay local and which ones you'll read about in the morning paper three continents away. The architecture, in the end, is the argument. The rest is commentary.